You click the button. The data shows up exactly where it should. Your chest does that little relieved-proud thing. It works! According to the article "Why “It Works” Isn’t Proof It’s Safe" by itskhalid_99 on DEV, that feeling is proof of exactly one thing: it works when you use it the way you intended, logged in as yourself. That is all it proves.
If you have spent time in IT, you have seen this trap before. A firewall rule that lets your own laptop traffic through tells you nothing about traffic from elsewhere. Testing an office door lock with your own keycard tells you nothing about whether it refuses a card that should not work. The mindset shift required is simple: stop asking 'does this work?' and start asking 'what happens when someone tries to make it not work, on purpose?'
Happy-path testing is you, logged in as yourself, clicking through the app the way you built it to be clicked through with expected inputs. Adversarial testing is different. It means logging in as a second, unprivileged account and trying to see what you should not see, or throwing blank fields, huge inputs, and wrong values at the app. According to the source, you do not need to write a single line of code for this. A second free email address and your browser's built-in developer tools are the entire toolkit.
AI coding tools will not catch this for you. As noted in the source, when you ask an AI tool for a feature, it builds exactly that feature and nothing more. It will not volunteer to check who else can see the data unless someone explicitly writes that into the process. The AI is fast, confident, and completely silent about the doors left wide open.
Every browser has a panel showing every request your app makes and what comes back. You right-click, select Inspect, and open the Network tab. Do the thing you are testing and read the status code that comes back:
200: It worked
401: You are not logged in
403: You are logged in, but blocked (usually a good sign)
500: Something broke on the serverTo build robust front-ends that resist security slip-ups and look sharp, you need a solid foundation right from the start. That is where our UI templates help you avoid generic AI design pitfalls while keeping your code clean and intentional.
Before you tell anyone your link is live, do a quick, honest gut check. Have you logged in as a second test account and tried to view the first account's data? Have you opened the Network tab and actually watched a request happen? Have you asked your AI tool who is allowed to call a specific endpoint, instead of just asking if it works? If those are unchecked, close that gap and try to break your own app before someone else does it for you.